CVE-2026-82666CWE-74CWE-94code-injection

CVE-2026-82666

Medium · published August 31, 2026

CVSS v3.1
4.7
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Controllers/Admin/SiteThemeEditorController.php of the component Superadmin Theme Editor. This manipulation of the argument blade causes code injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 2.1.1 is capable of addressing this issue. Patch name: 67abfd864a15d169a78429f3290c91cb3b93e849. Upgrading the affected component is advised.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00506 · 42.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-08-31T13:17Z
References (9)
https://github.com/yaojingang/GEOFlow/ · [email protected]https://github.com/yaojingang/GEOFlow/commit/67abfd864a15d169a78429f3290c91cb3b93e849 · [email protected]https://github.com/yaojingang/GEOFlow/issues/60 · [email protected]https://github.com/yaojingang/GEOFlow/pull/61 · [email protected]https://github.com/yaojingang/GEOFlow/releases/tag/v2.1.1 · [email protected]https://vuldb.com/cve/CVE-2026-82666 · [email protected]https://vuldb.com/submit/893854 · [email protected]https://vuldb.com/vuln/397160 · [email protected]https://vuldb.com/vuln/397160/cti · [email protected]
EPSS history
Timeline
  • 01 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 31 AUG 08:30Z
    yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection
    cvelistv5